a347e0709c0f0d266b7c2b6f6e4f453a3d18caac5a3a27242fe9112a011ed035

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 18:16

Target

$PLUGINSDIR/Ischeck.dll
Size

120KB
MD5

6c1f65ce96712e05f64c7a26b7adee36
SHA1

6cea6c2618fb31902c52cb1d5fad04503bd34ed0
SHA256

544f3c2c03f7900539d4868437f8e08204c0b4c79357af666a1fb48d406c1ffd
SHA512

5244d26d013dc2c7083bd4c167cac99307985babcabc1806a898a2621fce6b73d256b21d549bce8744f3221a51017ea5f621d2f6f5cd5aae83ec21ae41e5d5a6
SSDEEP

1536:1ki0RcSLEMxwjoTolPh9zyZFTEPmayYgH+t7Q0LtJhpdcOoyoJaZGUttW:IA/VHeZCP3ybHLK3hpdcO1oJaZttW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2212	3028	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 3028	1068	rundll32.exe	15
PID 1068 wrote to memory of 3028	1068	rundll32.exe	15
PID 1068 wrote to memory of 3028	1068	rundll32.exe	15
PID 1068 wrote to memory of 3028	1068	rundll32.exe	15
PID 1068 wrote to memory of 3028	1068	rundll32.exe	15
PID 1068 wrote to memory of 3028	1068	rundll32.exe	15
PID 1068 wrote to memory of 3028	1068	rundll32.exe	15
PID 3028 wrote to memory of 2212	3028	rundll32.exe	14
PID 3028 wrote to memory of 2212	3028	rundll32.exe	14
PID 3028 wrote to memory of 2212	3028	rundll32.exe	14
PID 3028 wrote to memory of 2212	3028	rundll32.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 240
1⤵
- Program crash
PID:2212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ischeck.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ischeck.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068